What’s Vulnerable › Products
statamic cms vulnerabilities
16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.
Check whether your statamic cms version is affected
Latest statamic cms vulnerabilities
- CVE-2026-71435 — Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template (CVSS 6.1)
- CVE-2026-71434 — Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types (CVSS 5.3)
- CVE-2026-64665 — Statamic: Account takeover via OAuth email matching without email-verification check (CVSS 8.1)
- CVE-2026-64664 — Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence (CVSS 4.3)
- CVE-2026-64663 — Statamic: Unsafe method invocation via Antlers template resolution allows data destruction (CVSS 6.5)
- CVE-2026-64662 — Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries (CVSS 6.5)
- CVE-2026-71293 — Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable (CVSS 6.2)
- CVE-2026-54244 — Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors (CVSS 3.5)
- CVE-2026-54243 — Statamic: CSV formula injection in form submission exports (CVSS 6.1)
- CVE-2026-54242 — Statamic: Server-Side Request Forgery via Glide (DNS rebinding) (CVSS 4.9)
- CVE-2026-49288 — Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources (CVSS 4.3)
- CVE-2026-49287 — Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction (CVSS 7.4)
- CVE-2026-45660 — Statamic: Server-Side Request Forgery via Glide (CVSS 5.4)
- CVE-2026-44306 — Statamic: Email enumeration via forgot password endpoint (CVSS 5.3)
- CVE-2025-64112 — Statmatic vulnerable to Stored Cross-Site Scripting (CVSS 8.0)
- CVE-2024-36119 — Password confirmation stored in plain text via registration form in statamic/cms (CVSS 1.8)